---
id: "CVE-2026-56130"
kind: "vulnerability"
aliases: ["CVE-2026-56130", "GHSA-m8g6-vrr2-x7ff"]
title: "Apache Shiro's \"remember me\" cookie age is not verified on the server."
severity: "low"
cvss: 2.0
epss: 0.00299
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.shiro:shiro-core", "fixed": ["3.0.0"], "affected": ">= 1.2.4, < 3.0.0", "ecosystem": "maven"}, {"name": "org.apache.shiro:shiro-web", "fixed": ["3.0.0"], "affected": ">= 1.2.4, < 3.0.0", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["apache-shiro", "cwe-294", "java", "maven", "package", "self-hosted"]
not_affected_if: ["default-config", "rememberme-disabled"]
published_at: "2026-06-25T09:16:46+00:00"
first_seen_at: "2026-11-03T21:30:11+00:00"
updated_at: "2026-11-03T22:07:19+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-m8g6-vrr2-x7ff", "first_seen_at": "2026-11-03T21:30:11+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56130", "first_seen_at": "2026-11-03T22:07:19+00:00"}]
---

# Apache Shiro's "remember me" cookie age is not verified on the server.

Apache Shiro does not check the age of its "remember me" cookie on the server, so an expired cookie still logs a user in. An attacker who intercepts a valid cookie can reuse it indefinitely.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.shiro:shiro-core affected >= 1.2.4, < 3.0.0 fixed 3.0.0
- maven:org.apache.shiro:shiro-web affected >= 1.2.4, < 3.0.0 fixed 3.0.0

## How to check

- Check the version of `org.apache.shiro:shiro-core` and `org.apache.shiro:shiro-web` in the project's Maven dependencies.
- Confirm whether RememberMe is enabled in the Shiro configuration (`rememberMe` manager or cookie settings).

## Fix

- Upgrade `org.apache.shiro:shiro-core` and `org.apache.shiro:shiro-web` to `3.0.0` or later.

## Timeline

- 2026-11-03T21:30:11+00:00 ghsa https://github.com/advisories/GHSA-m8g6-vrr2-x7ff
- 2026-11-03T22:07:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56130

## Documents

- [fix] Patch: github.com https://github.com/apache/shiro/commit/e441ea37009a426b122c53b0120ae5879d00e354

## From the sources

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.
This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.


Upgrade to version 3.0.0 or later, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_